Fraud & Transaction Security API Documentation

POSThttps://www.brainiac.software/api/v1/fraud-signals/payment-fraud-pattern-detect$0.05 USDC

Detect payment fraud patterns

Detect suspicious combinations of caller-supplied payment events (declines-then-success, instrument churn, billing/shipping mismatch). Anomalies are not confirmed fraud.

Body

Field	Required	Notes
`text`	No	string
`json`	No	string
`csv`	No	string
`file`	No	object; Object
`files`	No	array; Array
`payments`	No	array; Array
`transactions`	No	array; Array
`identities`	No	array; Array
`invoices`	No	array; Array
`asOf`	No	string
`velocityWindowMinutes`	No	number
`velocityCountThreshold`	No	number
`velocityAmountThreshold`	No	number
`refundWindowDays`	No	number
`chargebackWindowDays`	No	number
`bankChangeRiskHours`	No	number

Request exampleJSON

{
  "asOf": "2026-11-04T21:00:00.000Z",
  "payments": [
    {
      "id": "P1",
      "at": "2026-11-04T20:00:00.000Z",
      "customerId": "C1",
      "eventType": "purchase",
      "status": "declined",
      "amount": 120,
      "currency": "USD",
      "cardLast4": "1111",
      "deviceId": "d1",
      "email": "a@example.com",
      "billingCountry": "US",
      "shippingCountry": "US",
      "source": "Caller-supplied"
    },
    {
      "id": "P2",
      "at": "2026-11-04T20:01:00.000Z",
      "customerId": "C1",
      "eventType": "purchase",
      "status": "declined",
      "amount": 120,
      "currency": "USD",
      "cardLast4": "2222",
      "deviceId": "d1",
      "email": "a@example.com",
      "source": "Caller-supplied"
    },
    {
      "id": "P3",
      "at": "2026-11-04T20:02:00.000Z",
      "customerId": "C1",
      "eventType": "purchase",
      "status": "declined",
      "amount": 120,
      "currency": "USD",
      "cardLast4": "3333",
      "deviceId": "d1",
      "email": "a@example.com",
      "source": "Caller-supplied"
    },
    {
      "id": "P4",
      "at": "2026-11-04T20:03:00.000Z",
      "customerId": "C1",
      "eventType": "purchase",
      "status": "completed",
      "amount": 120,
      "currency": "USD",
      "cardLast4": "4444",
      "deviceId": "d1",
      "email": "b@example.com",
      "billingCountry": "US",
      "shippingCountry": "DE",
      "source": "Caller-supplied"
    }
  ]
}

Response exampleJSON

{
  "checkedAt": "2026-11-04T21:00:00.000Z",
  "status": "detected",
  "itemCount": 1,
  "items": [
    {
      "id": "payment-fraud-c1",
      "detector": "payment-fraud-pattern-detect",
      "title": "Suspicious payment event combination",
      "observedFacts": [
        "3 declines/failures and 1 success(es) for the same actor.",
        "4 payment instruments on 1 device id(s).",
        "2 emails with multiple instruments/devices.",
        "1 event(s) with billing≠shipping country."
      ],
      "inferredThreat": "Combined decline/success, instrument churn, or geo mismatch patterns can indicate payment fraud.",
      "confidence": "high",
      "relatedRecordIds": [
        "P1",
        "P2",
        "P3",
        "P4"
      ],
      "firstAt": "2026-11-04T20:00:00.000Z",
      "lastAt": "2026-11-04T20:03:00.000Z",
      "reasons": [
        "declines_then_success",
        "many_cards_one_device",
        "identity_instrument_churn",
        "billing_shipping_country_mismatch"
      ],
      "evidence": [
        {
          "recordId": "P1",
          "at": "2026-11-04T20:00:00.000Z",
          "fact": "purchase status=declined; USD 120; card…1111; email=a***@example.com; device=d1",
          "inference": "Payment-pattern indicators are not confirmed fraud by themselves.",
          "confidence": "medium"
        },
        {
          "recordId": "P2",
          "at": "2026-11-04T20:01:00.000Z",
          "fact": "purchase status=declined; USD 120; card…2222; email=a***@example.com; device=d1",
          "inference": "Payment-pattern indicators are not confirmed fraud by themselves.",
          "confidence": "medium"
        },
        {
          "recordId": "P3",
          "at": "2026-11-04T20:02:00.000Z",
          "fact": "purchase status=declined; USD 120; card…3333; email=a***@example.com; device=d1",
          "inference": "Payment-pattern indicators are not confirmed fraud by themselves.",
          "confidence": "medium"
        },
        {
          "recordId": "P4",
          "at": "2026-11-04T20:03:00.000Z",
          "fact": "purchase status=completed; USD 120; card…4444; email=b***@example.com; device=d1",
          "inference": "Payment-pattern indicators are not confirmed fraud by themselves.",
          "confidence": "medium"
        }
      ],
      "source": "Caller-supplied payments; local deterministic rules",
      "status": "signal",
      "confirmedFraud": false
    }
  ],
  "paidProviderUsed": false,
  "apiKeyRequired": false,
  "paymentProcessorConnected": false,
  "financialAccountAccessed": false,
  "networkAccessed": false,
  "confirmedFraudClaimed": false,
  "findings": [
    {
      "kind": "conflict",
      "code": "payment_fraud_pattern",
      "subject": "c1",
      "detail": "Payment-pattern indicators: declines_then_success, many_cards_one_device, identity_instrument_churn, billing_shipping_country_mismatch (confirmedFraud=false)."
    }
  ],
  "limitations": [
    "Payment records, invoices, identity rows, and transaction histories are copied only from caller-supplied fields. Payment processors and financial accounts are never contacted.",
    "Matching and velocity checks are deterministic local rules over supplied records. Missing values are not invented.",
    "Observed facts are separated from inferred risk hypotheses. Statistical anomalies alone are never labeled confirmed fraud.",
    "Personal and financial identifiers are masked in responses (email local-part hashed length, last4 only for cards/accounts).",
    "No paid fraud-intel feed is used and no API key is required."
  ]
}

cURL

curl -i -X POST "https://www.brainiac.software/api/v1/fraud-signals/payment-fraud-pattern-detect" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "asOf": "2026-11-04T21:00:00.000Z",
  "payments": [
    {
      "id": "P1",
      "at": "2026-11-04T20:00:00.000Z",
      "customerId": "C1",
      "eventType": "purchase",
      "status": "declined",
      "amount": 120,
      "currency": "USD",
      "cardLast4": "1111",
      "deviceId": "d1",
      "email": "a@example.com",
      "billingCountry": "US",
      "shippingCountry": "US",
      "source": "Caller-supplied"
    },
    {
      "id": "P2",
      "at": "2026-11-04T20:01:00.000Z",
      "customerId": "C1",
      "eventType": "purchase",
      "status": "declined",
      "amount": 120,
      "currency": "USD",
      "cardLast4": "2222",
      "deviceId": "d1",
      "email": "a@example.com",
      "source": "Caller-supplied"
    },
    {
      "id": "P3",
      "at": "2026-11-04T20:02:00.000Z",
      "customerId": "C1",
      "eventType": "purchase",
      "status": "declined",
      "amount": 120,
      "currency": "USD",
      "cardLast4": "3333",
      "deviceId": "d1",
      "email": "a@example.com",
      "source": "Caller-supplied"
    },
    {
      "id": "P4",
      "at": "2026-11-04T20:03:00.000Z",
      "customerId": "C1",
      "eventType": "purchase",
      "status": "completed",
      "amount": 120,
      "currency": "USD",
      "cardLast4": "4444",
      "deviceId": "d1",
      "email": "b@example.com",
      "billingCountry": "US",
      "shippingCountry": "DE",
      "source": "Caller-supplied"
    }
  ]
}
JSON

POSThttps://www.brainiac.software/api/v1/fraud-signals/transaction-velocity-analyze$0.04 USDC

Analyze transaction velocity

Identify abnormal transaction frequency and amount velocity from caller-supplied histories. Velocity spikes alone are never labeled confirmed fraud.

Body

Field	Required	Notes
`text`	No	string
`json`	No	string
`csv`	No	string
`file`	No	object; Object
`files`	No	array; Array
`payments`	No	array; Array
`transactions`	No	array; Array
`identities`	No	array; Array
`invoices`	No	array; Array
`asOf`	No	string
`velocityWindowMinutes`	No	number
`velocityCountThreshold`	No	number
`velocityAmountThreshold`	No	number
`refundWindowDays`	No	number
`chargebackWindowDays`	No	number
`bankChangeRiskHours`	No	number

Request exampleJSON

{
  "asOf": "2026-11-04T21:00:00.000Z",
  "velocityWindowMinutes": 30,
  "velocityCountThreshold": 5,
  "velocityAmountThreshold": 1000,
  "transactions": [
    {
      "id": "T1",
      "at": "2026-11-04T20:00:00.000Z",
      "customerId": "C2",
      "eventType": "purchase",
      "status": "completed",
      "amount": 250,
      "currency": "USD",
      "source": "Caller-supplied"
    },
    {
      "id": "T2",
      "at": "2026-11-04T20:02:00.000Z",
      "customerId": "C2",
      "eventType": "purchase",
      "status": "completed",
      "amount": 250,
      "currency": "USD",
      "source": "Caller-supplied"
    },
    {
      "id": "T3",
      "at": "2026-11-04T20:04:00.000Z",
      "customerId": "C2",
      "eventType": "purchase",
      "status": "completed",
      "amount": 250,
      "currency": "USD",
      "source": "Caller-supplied"
    },
    {
      "id": "T4",
      "at": "2026-11-04T20:06:00.000Z",
      "customerId": "C2",
      "eventType": "purchase",
      "status": "completed",
      "amount": 250,
      "currency": "USD",
      "source": "Caller-supplied"
    },
    {
      "id": "T5",
      "at": "2026-11-04T20:08:00.000Z",
      "customerId": "C2",
      "eventType": "purchase",
      "status": "completed",
      "amount": 250,
      "currency": "USD",
      "source": "Caller-supplied"
    }
  ]
}

Response exampleJSON

{
  "checkedAt": "2026-11-04T21:00:00.000Z",
  "status": "detected",
  "itemCount": 1,
  "windowMinutes": 30,
  "items": [
    {
      "id": "velocity-c2-T1",
      "detector": "transaction-velocity-analyze",
      "title": "Abnormal transaction velocity",
      "status": "signal",
      "observedFacts": [
        "5 transactions within 30 minutes (threshold 5).",
        "Sum USD 1250 within window (threshold 1000)."
      ],
      "inferredThreat": "Elevated frequency/amount velocity can indicate abuse; a velocity spike alone is not confirmed fraud.",
      "confidence": "medium",
      "relatedRecordIds": [
        "T1",
        "T2",
        "T3",
        "T4",
        "T5"
      ],
      "firstAt": "2026-11-04T20:00:00.000Z",
      "lastAt": "2026-11-04T20:08:00.000Z",
      "reasons": [
        "count_velocity",
        "amount_velocity"
      ],
      "evidence": [
        {
          "recordId": "T1",
          "at": "2026-11-04T20:00:00.000Z",
          "fact": "purchase status=completed; USD 250",
          "inference": "Velocity is a statistical indicator only.",
          "confidence": "medium"
        },
        {
          "recordId": "T2",
          "at": "2026-11-04T20:02:00.000Z",
          "fact": "purchase status=completed; USD 250",
          "inference": "Velocity is a statistical indicator only.",
          "confidence": "medium"
        },
        {
          "recordId": "T3",
          "at": "2026-11-04T20:04:00.000Z",
          "fact": "purchase status=completed; USD 250",
          "inference": "Velocity is a statistical indicator only.",
          "confidence": "medium"
        },
        {
          "recordId": "T4",
          "at": "2026-11-04T20:06:00.000Z",
          "fact": "purchase status=completed; USD 250",
          "inference": "Velocity is a statistical indicator only.",
          "confidence": "medium"
        },
        {
          "recordId": "T5",
          "at": "2026-11-04T20:08:00.000Z",
          "fact": "purchase status=completed; USD 250",
          "inference": "Velocity is a statistical indicator only.",
          "confidence": "medium"
        }
      ],
      "source": "Caller-supplied transactions; local time-window rules",
      "confirmedFraud": false
    }
  ],
  "paidProviderUsed": false,
  "apiKeyRequired": false,
  "paymentProcessorConnected": false,
  "financialAccountAccessed": false,
  "networkAccessed": false,
  "confirmedFraudClaimed": false,
  "findings": [
    {
      "kind": "conflict",
      "code": "velocity",
      "subject": "c2",
      "detail": "Velocity indicators: count_velocity, amount_velocity (confirmedFraud=false; anomaly≠confirmed)."
    }
  ],
  "limitations": [
    "Payment records, invoices, identity rows, and transaction histories are copied only from caller-supplied fields. Payment processors and financial accounts are never contacted.",
    "Matching and velocity checks are deterministic local rules over supplied records. Missing values are not invented.",
    "Observed facts are separated from inferred risk hypotheses. Statistical anomalies alone are never labeled confirmed fraud.",
    "Personal and financial identifiers are masked in responses (email local-part hashed length, last4 only for cards/accounts).",
    "No paid fraud-intel feed is used and no API key is required."
  ]
}

cURL

curl -i -X POST "https://www.brainiac.software/api/v1/fraud-signals/transaction-velocity-analyze" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "asOf": "2026-11-04T21:00:00.000Z",
  "velocityWindowMinutes": 30,
  "velocityCountThreshold": 5,
  "velocityAmountThreshold": 1000,
  "transactions": [
    {
      "id": "T1",
      "at": "2026-11-04T20:00:00.000Z",
      "customerId": "C2",
      "eventType": "purchase",
      "status": "completed",
      "amount": 250,
      "currency": "USD",
      "source": "Caller-supplied"
    },
    {
      "id": "T2",
      "at": "2026-11-04T20:02:00.000Z",
      "customerId": "C2",
      "eventType": "purchase",
      "status": "completed",
      "amount": 250,
      "currency": "USD",
      "source": "Caller-supplied"
    },
    {
      "id": "T3",
      "at": "2026-11-04T20:04:00.000Z",
      "customerId": "C2",
      "eventType": "purchase",
      "status": "completed",
      "amount": 250,
      "currency": "USD",
      "source": "Caller-supplied"
    },
    {
      "id": "T4",
      "at": "2026-11-04T20:06:00.000Z",
      "customerId": "C2",
      "eventType": "purchase",
      "status": "completed",
      "amount": 250,
      "currency": "USD",
      "source": "Caller-supplied"
    },
    {
      "id": "T5",
      "at": "2026-11-04T20:08:00.000Z",
      "customerId": "C2",
      "eventType": "purchase",
      "status": "completed",
      "amount": 250,
      "currency": "USD",
      "source": "Caller-supplied"
    }
  ]
}
JSON

POSThttps://www.brainiac.software/api/v1/fraud-signals/synthetic-identity-signal-detect$0.04 USDC

Detect synthetic-identity signals

Identify inconsistencies in caller-supplied identity records (sparse profiles, age/postal mismatches, shared contacts). Personal data is masked in responses.

Body

Field	Required	Notes
`text`	No	string
`json`	No	string
`csv`	No	string
`file`	No	object; Object
`files`	No	array; Array
`payments`	No	array; Array
`transactions`	No	array; Array
`identities`	No	array; Array
`invoices`	No	array; Array
`asOf`	No	string
`velocityWindowMinutes`	No	number
`velocityCountThreshold`	No	number
`velocityAmountThreshold`	No	number
`refundWindowDays`	No	number
`chargebackWindowDays`	No	number
`bankChangeRiskHours`	No	number

Request exampleJSON

{
  "asOf": "2026-11-04T21:00:00.000Z",
  "identities": [
    {
      "id": "I1",
      "accountId": "A1",
      "fullName": "Jane Doe",
      "email": "x99999@mail.example",
      "phone": "12",
      "dateOfBirth": "2018-01-01",
      "postalCode": "10001",
      "country": "DE",
      "source": "Caller-supplied"
    },
    {
      "id": "I2",
      "accountId": "A2",
      "fullName": "Jon D",
      "email": "x99999@mail.example",
      "phone": "12",
      "deviceId": "shared-device",
      "source": "Caller-supplied"
    }
  ]
}

Response exampleJSON

{
  "checkedAt": "2026-11-04T21:00:00.000Z",
  "status": "detected",
  "itemCount": 2,
  "items": [
    {
      "id": "synthetic-I1",
      "detector": "synthetic-identity-signal-detect",
      "title": "Synthetic identity inconsistencies",
      "observedFacts": [
        "Email local-part x***@mail.example does not reflect supplied name token.",
        "Derived age ≈9 years from supplied dateOfBirth.",
        "US-style postal code with non-US country.",
        "One or more core identity fields (name/email/address) are missing.",
        "Phone appears too short after normalization ([redacted-phone]).",
        "Email/phone/device identifiers overlap multiple identity records."
      ],
      "inferredThreat": "Inconsistent or sparse identity attributes can indicate synthetic identity construction.",
      "confidence": "high",
      "relatedRecordIds": [
        "I1",
        "I2",
        "I2"
      ],
      "firstAt": "2026-11-04T21:00:00.000Z",
      "lastAt": "2026-11-04T21:00:00.000Z",
      "reasons": [
        "email_name_mismatch",
        "implausible_age",
        "postal_country_mismatch",
        "sparse_identity_profile",
        "invalid_phone_shape",
        "shared_contact_across_identities"
      ],
      "evidence": [
        {
          "recordId": "I1",
          "at": "2026-11-04T21:00:00.000Z",
          "fact": "name=[supplied]; email=x***@mail.example; phone=[redacted-phone]; country=DE",
          "inference": "Synthetic-identity signals are inconsistencies, not confirmed fraud.",
          "confidence": "medium"
        }
      ],
      "source": "Caller-supplied",
      "status": "signal",
      "confirmedFraud": false
    },
    {
      "id": "synthetic-I2",
      "detector": "synthetic-identity-signal-detect",
      "title": "Synthetic identity inconsistencies",
      "observedFacts": [
        "Email local-part x***@mail.example does not reflect supplied name token.",
        "One or more core identity fields (name/email/address) are missing.",
        "Phone appears too short after normalization ([redacted-phone]).",
        "Email/phone/device identifiers overlap multiple identity records."
      ],
      "inferredThreat": "Inconsistent or sparse identity attributes can indicate synthetic identity construction.",
      "confidence": "high",
      "relatedRecordIds": [
        "I2",
        "I1",
        "I1"
      ],
      "firstAt": "2026-11-04T21:00:00.000Z",
      "lastAt": "2026-11-04T21:00:00.000Z",
      "reasons": [
        "email_name_mismatch",
        "sparse_identity_profile",
        "invalid_phone_shape",
        "shared_contact_across_identities"
      ],
      "evidence": [
        {
          "recordId": "I2",
          "at": "2026-11-04T21:00:00.000Z",
          "fact": "name=[supplied]; email=x***@mail.example; phone=[redacted-phone]; country=n/a",
          "inference": "Synthetic-identity signals are inconsistencies, not confirmed fraud.",
          "confidence": "medium"
        }
      ],
      "source": "Caller-supplied",
      "status": "signal",
      "confirmedFraud": false
    }
  ],
  "paidProviderUsed": false,
  "apiKeyRequired": false,
  "paymentProcessorConnected": false,
  "financialAccountAccessed": false,
  "networkAccessed": false,
  "confirmedFraudClaimed": false,
  "findings": [
    {
      "kind": "conflict",
      "code": "synthetic_identity",
      "subject": "I1",
      "detail": "Synthetic-identity indicators: email_name_mismatch, implausible_age, postal_country_mismatch, sparse_identity_profile, invalid_phone_shape, shared_contact_across_identities (confirmedFraud=false)."
    },
    {
      "kind": "conflict",
      "code": "synthetic_identity",
      "subject": "I2",
      "detail": "Synthetic-identity indicators: email_name_mismatch, sparse_identity_profile, invalid_phone_shape, shared_contact_across_identities (confirmedFraud=false)."
    }
  ],
  "limitations": [
    "Payment records, invoices, identity rows, and transaction histories are copied only from caller-supplied fields. Payment processors and financial accounts are never contacted.",
    "Matching and velocity checks are deterministic local rules over supplied records. Missing values are not invented.",
    "Observed facts are separated from inferred risk hypotheses. Statistical anomalies alone are never labeled confirmed fraud.",
    "Personal and financial identifiers are masked in responses (email local-part hashed length, last4 only for cards/accounts).",
    "No paid fraud-intel feed is used and no API key is required."
  ]
}

cURL

curl -i -X POST "https://www.brainiac.software/api/v1/fraud-signals/synthetic-identity-signal-detect" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "asOf": "2026-11-04T21:00:00.000Z",
  "identities": [
    {
      "id": "I1",
      "accountId": "A1",
      "fullName": "Jane Doe",
      "email": "x99999@mail.example",
      "phone": "12",
      "dateOfBirth": "2018-01-01",
      "postalCode": "10001",
      "country": "DE",
      "source": "Caller-supplied"
    },
    {
      "id": "I2",
      "accountId": "A2",
      "fullName": "Jon D",
      "email": "x99999@mail.example",
      "phone": "12",
      "deviceId": "shared-device",
      "source": "Caller-supplied"
    }
  ]
}
JSON

POSThttps://www.brainiac.software/api/v1/fraud-signals/invoice-fraud-signal-detect$0.04 USDC

Detect invoice fraud signals

Detect potentially manipulated invoices from caller-supplied invoice exports (duplicate numbers, tax anomalies, missing PO). Not confirmed fraud.

Body

Field	Required	Notes
`text`	No	string
`json`	No	string
`csv`	No	string
`file`	No	object; Object
`files`	No	array; Array
`payments`	No	array; Array
`transactions`	No	array; Array
`identities`	No	array; Array
`invoices`	No	array; Array
`asOf`	No	string
`velocityWindowMinutes`	No	number
`velocityCountThreshold`	No	number
`velocityAmountThreshold`	No	number
`refundWindowDays`	No	number
`chargebackWindowDays`	No	number
`bankChangeRiskHours`	No	number

Request exampleJSON

{
  "asOf": "2026-11-04T21:00:00.000Z",
  "invoices": [
    {
      "id": "INV1",
      "at": "2026-11-04T18:00:00.000Z",
      "supplierId": "SUP1",
      "invoiceNumber": "1001",
      "amount": 10000,
      "currency": "USD",
      "taxAmount": 5,
      "lineCount": 0,
      "source": "Caller-supplied"
    },
    {
      "id": "INV2",
      "at": "2026-11-04T19:00:00.000Z",
      "supplierId": "SUP1",
      "invoiceNumber": "1001",
      "amount": 10000,
      "currency": "USD",
      "source": "Caller-supplied"
    }
  ]
}

Response exampleJSON

{
  "checkedAt": "2026-11-04T21:00:00.000Z",
  "status": "detected",
  "itemCount": 2,
  "items": [
    {
      "id": "invoice-fraud-INV1",
      "detector": "invoice-fraud-signal-detect",
      "title": "Invoice fraud / manipulation indicators",
      "observedFacts": [
        "2 invoices share supplier+invoiceNumber.",
        "Tax/amount ratio ≈0.001.",
        "High-value invoice has no PO number.",
        "Positive amount with zero line items."
      ],
      "inferredThreat": "Duplicate numbers, tax anomalies, or missing controls can indicate invoice fraud.",
      "confidence": "high",
      "relatedRecordIds": [
        "INV1",
        "INV1",
        "INV2"
      ],
      "firstAt": "2026-11-04T18:00:00.000Z",
      "lastAt": "2026-11-04T18:00:00.000Z",
      "reasons": [
        "duplicate_invoice_number",
        "implausible_tax",
        "high_value_missing_po",
        "amount_without_lines"
      ],
      "evidence": [
        {
          "recordId": "INV1",
          "at": "2026-11-04T18:00:00.000Z",
          "fact": "supplier=SUP1; number=1001; amount=USD 10000; bank…n/a",
          "inference": "Invoice anomalies are risk indicators, not confirmed fraud.",
          "confidence": "medium"
        }
      ],
      "source": "Caller-supplied",
      "status": "signal",
      "confirmedFraud": false
    },
    {
      "id": "invoice-fraud-INV2",
      "detector": "invoice-fraud-signal-detect",
      "title": "Invoice fraud / manipulation indicators",
      "observedFacts": [
        "2 invoices share supplier+invoiceNumber.",
        "High-value invoice has no PO number.",
        "Round high amount without supporting line detail."
      ],
      "inferredThreat": "Duplicate numbers, tax anomalies, or missing controls can indicate invoice fraud.",
      "confidence": "high",
      "relatedRecordIds": [
        "INV2",
        "INV1",
        "INV2"
      ],
      "firstAt": "2026-11-04T19:00:00.000Z",
      "lastAt": "2026-11-04T19:00:00.000Z",
      "reasons": [
        "duplicate_invoice_number",
        "high_value_missing_po",
        "round_amount_pattern"
      ],
      "evidence": [
        {
          "recordId": "INV2",
          "at": "2026-11-04T19:00:00.000Z",
          "fact": "supplier=SUP1; number=1001; amount=USD 10000; bank…n/a",
          "inference": "Invoice anomalies are risk indicators, not confirmed fraud.",
          "confidence": "medium"
        }
      ],
      "source": "Caller-supplied",
      "status": "signal",
      "confirmedFraud": false
    }
  ],
  "paidProviderUsed": false,
  "apiKeyRequired": false,
  "paymentProcessorConnected": false,
  "financialAccountAccessed": false,
  "networkAccessed": false,
  "confirmedFraudClaimed": false,
  "findings": [
    {
      "kind": "conflict",
      "code": "invoice_fraud",
      "subject": "INV1",
      "detail": "Invoice indicators: duplicate_invoice_number, implausible_tax, high_value_missing_po, amount_without_lines (confirmedFraud=false)."
    },
    {
      "kind": "conflict",
      "code": "invoice_fraud",
      "subject": "INV2",
      "detail": "Invoice indicators: duplicate_invoice_number, high_value_missing_po, round_amount_pattern (confirmedFraud=false)."
    }
  ],
  "limitations": [
    "Payment records, invoices, identity rows, and transaction histories are copied only from caller-supplied fields. Payment processors and financial accounts are never contacted.",
    "Matching and velocity checks are deterministic local rules over supplied records. Missing values are not invented.",
    "Observed facts are separated from inferred risk hypotheses. Statistical anomalies alone are never labeled confirmed fraud.",
    "Personal and financial identifiers are masked in responses (email local-part hashed length, last4 only for cards/accounts).",
    "No paid fraud-intel feed is used and no API key is required."
  ]
}

cURL

curl -i -X POST "https://www.brainiac.software/api/v1/fraud-signals/invoice-fraud-signal-detect" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "asOf": "2026-11-04T21:00:00.000Z",
  "invoices": [
    {
      "id": "INV1",
      "at": "2026-11-04T18:00:00.000Z",
      "supplierId": "SUP1",
      "invoiceNumber": "1001",
      "amount": 10000,
      "currency": "USD",
      "taxAmount": 5,
      "lineCount": 0,
      "source": "Caller-supplied"
    },
    {
      "id": "INV2",
      "at": "2026-11-04T19:00:00.000Z",
      "supplierId": "SUP1",
      "invoiceNumber": "1001",
      "amount": 10000,
      "currency": "USD",
      "source": "Caller-supplied"
    }
  ]
}
JSON

POSThttps://www.brainiac.software/api/v1/fraud-signals/supplier-bank-change-risk$0.04 USDC

Assess supplier bank-change risk

Identify suspicious supplier bank-detail changes near invoice timing from caller-supplied records. Bank values are last4-masked.

Body

Field	Required	Notes
`text`	No	string
`json`	No	string
`csv`	No	string
`file`	No	object; Object
`files`	No	array; Array
`payments`	No	array; Array
`transactions`	No	array; Array
`identities`	No	array; Array
`invoices`	No	array; Array
`asOf`	No	string
`velocityWindowMinutes`	No	number
`velocityCountThreshold`	No	number
`velocityAmountThreshold`	No	number
`refundWindowDays`	No	number
`chargebackWindowDays`	No	number
`bankChangeRiskHours`	No	number

Request exampleJSON

{
  "asOf": "2026-11-04T21:00:00.000Z",
  "bankChangeRiskHours": 72,
  "invoices": [
    {
      "id": "INV9",
      "at": "2026-11-04T20:00:00.000Z",
      "supplierId": "SUP9",
      "invoiceNumber": "9001",
      "amount": 25000,
      "currency": "USD",
      "bankAccountLast4": "8888",
      "previousBankAccountLast4": "1234",
      "bankChangedAt": "2026-11-04T10:00:00.000Z",
      "source": "Caller-supplied AP export"
    }
  ]
}

Response exampleJSON

{
  "checkedAt": "2026-11-04T21:00:00.000Z",
  "status": "detected",
  "itemCount": 1,
  "items": [
    {
      "id": "supplier-bank-INV9",
      "detector": "supplier-bank-change-risk",
      "title": "Suspicious supplier bank-detail change",
      "observedFacts": [
        "Bank details changed (…1234 → …8888).",
        "Invoice timed within 72 hours of bank-detail change.",
        "High-value invoice USD 25000 after bank change.",
        "No PO number on invoice after bank change."
      ],
      "inferredThreat": "Bank detail changes shortly before payment can indicate supplier payment diversion.",
      "confidence": "high",
      "relatedRecordIds": [
        "INV9"
      ],
      "firstAt": "2026-11-04T10:00:00.000Z",
      "lastAt": "2026-11-04T20:00:00.000Z",
      "reasons": [
        "bank_details_changed",
        "invoice_soon_after_bank_change",
        "high_value_after_change",
        "missing_po_after_change"
      ],
      "evidence": [
        {
          "recordId": "INV9",
          "at": "2026-11-04T10:00:00.000Z",
          "fact": "supplier=SUP9; bank…8888; prev…1234",
          "inference": "Supplier bank-change timing is a risk indicator, not confirmed fraud.",
          "confidence": "medium"
        }
      ],
      "source": "Caller-supplied AP export",
      "status": "signal",
      "confirmedFraud": false
    }
  ],
  "paidProviderUsed": false,
  "apiKeyRequired": false,
  "paymentProcessorConnected": false,
  "financialAccountAccessed": false,
  "networkAccessed": false,
  "confirmedFraudClaimed": false,
  "findings": [
    {
      "kind": "conflict",
      "code": "supplier_bank_change",
      "subject": "SUP9",
      "detail": "Supplier bank-change indicators: bank_details_changed, invoice_soon_after_bank_change, high_value_after_change, missing_po_after_change (confirmedFraud=false)."
    }
  ],
  "limitations": [
    "Payment records, invoices, identity rows, and transaction histories are copied only from caller-supplied fields. Payment processors and financial accounts are never contacted.",
    "Matching and velocity checks are deterministic local rules over supplied records. Missing values are not invented.",
    "Observed facts are separated from inferred risk hypotheses. Statistical anomalies alone are never labeled confirmed fraud.",
    "Personal and financial identifiers are masked in responses (email local-part hashed length, last4 only for cards/accounts).",
    "No paid fraud-intel feed is used and no API key is required."
  ]
}

cURL

curl -i -X POST "https://www.brainiac.software/api/v1/fraud-signals/supplier-bank-change-risk" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "asOf": "2026-11-04T21:00:00.000Z",
  "bankChangeRiskHours": 72,
  "invoices": [
    {
      "id": "INV9",
      "at": "2026-11-04T20:00:00.000Z",
      "supplierId": "SUP9",
      "invoiceNumber": "9001",
      "amount": 25000,
      "currency": "USD",
      "bankAccountLast4": "8888",
      "previousBankAccountLast4": "1234",
      "bankChangedAt": "2026-11-04T10:00:00.000Z",
      "source": "Caller-supplied AP export"
    }
  ]
}
JSON

POSThttps://www.brainiac.software/api/v1/fraud-signals/refund-abuse-pattern-detect$0.04 USDC

Detect refund-abuse patterns

Detect abnormal refund frequency and amount ratios from caller-supplied payment histories. Refund rate alone is not confirmed fraud.

Body

Field	Required	Notes
`text`	No	string
`json`	No	string
`csv`	No	string
`file`	No	object; Object
`files`	No	array; Array
`payments`	No	array; Array
`transactions`	No	array; Array
`identities`	No	array; Array
`invoices`	No	array; Array
`asOf`	No	string
`velocityWindowMinutes`	No	number
`velocityCountThreshold`	No	number
`velocityAmountThreshold`	No	number
`refundWindowDays`	No	number
`chargebackWindowDays`	No	number
`bankChangeRiskHours`	No	number

Request exampleJSON

{
  "asOf": "2026-11-04T21:00:00.000Z",
  "refundWindowDays": 30,
  "payments": [
    {
      "id": "P1",
      "at": "2026-11-01T12:00:00.000Z",
      "customerId": "C3",
      "eventType": "purchase",
      "status": "completed",
      "amount": 80,
      "currency": "USD",
      "source": "Caller-supplied"
    },
    {
      "id": "P2",
      "at": "2026-11-01T18:00:00.000Z",
      "customerId": "C3",
      "eventType": "refund",
      "status": "refunded",
      "amount": 80,
      "currency": "USD",
      "source": "Caller-supplied"
    },
    {
      "id": "P3",
      "at": "2026-11-02T12:00:00.000Z",
      "customerId": "C3",
      "eventType": "purchase",
      "status": "completed",
      "amount": 60,
      "currency": "USD",
      "source": "Caller-supplied"
    },
    {
      "id": "P4",
      "at": "2026-11-02T16:00:00.000Z",
      "customerId": "C3",
      "eventType": "refund",
      "status": "refunded",
      "amount": 60,
      "currency": "USD",
      "source": "Caller-supplied"
    },
    {
      "id": "P5",
      "at": "2026-11-03T12:00:00.000Z",
      "customerId": "C3",
      "eventType": "purchase",
      "status": "completed",
      "amount": 40,
      "currency": "USD",
      "source": "Caller-supplied"
    },
    {
      "id": "P6",
      "at": "2026-11-03T15:00:00.000Z",
      "customerId": "C3",
      "eventType": "refund",
      "status": "refunded",
      "amount": 40,
      "currency": "USD",
      "source": "Caller-supplied"
    }
  ]
}

Response exampleJSON

{
  "checkedAt": "2026-11-04T21:00:00.000Z",
  "status": "detected",
  "itemCount": 1,
  "windowDays": 30,
  "items": [
    {
      "id": "refund-abuse-c3",
      "detector": "refund-abuse-pattern-detect",
      "title": "Abnormal refund pattern",
      "status": "signal",
      "observedFacts": [
        "3 refunds within 30 days.",
        "Refund count is ≥50% of purchase count (3/3).",
        "Refund amount ratio ≈100%.",
        "3 same-amount refunds within 24h of a purchase."
      ],
      "inferredThreat": "Elevated refund frequency/ratio can indicate refund abuse; rate alone is not confirmed fraud.",
      "confidence": "medium",
      "relatedRecordIds": [
        "P2",
        "P4",
        "P6",
        "P1",
        "P3",
        "P5"
      ],
      "firstAt": "2026-11-01T12:00:00.000Z",
      "lastAt": "2026-11-03T15:00:00.000Z",
      "reasons": [
        "repeat_refunds",
        "high_refund_rate",
        "high_refund_amount_ratio",
        "rapid_full_refunds"
      ],
      "evidence": [
        {
          "recordId": "P2",
          "at": "2026-11-01T18:00:00.000Z",
          "fact": "refund status=refunded; USD 80",
          "inference": "Refund-pattern indicator only.",
          "confidence": "medium"
        },
        {
          "recordId": "P4",
          "at": "2026-11-02T16:00:00.000Z",
          "fact": "refund status=refunded; USD 60",
          "inference": "Refund-pattern indicator only.",
          "confidence": "medium"
        },
        {
          "recordId": "P6",
          "at": "2026-11-03T15:00:00.000Z",
          "fact": "refund status=refunded; USD 40",
          "inference": "Refund-pattern indicator only.",
          "confidence": "medium"
        }
      ],
      "source": "Caller-supplied payments; local refund rules",
      "confirmedFraud": false
    }
  ],
  "paidProviderUsed": false,
  "apiKeyRequired": false,
  "paymentProcessorConnected": false,
  "financialAccountAccessed": false,
  "networkAccessed": false,
  "confirmedFraudClaimed": false,
  "findings": [
    {
      "kind": "conflict",
      "code": "refund_abuse",
      "subject": "c3",
      "detail": "Refund-abuse indicators: repeat_refunds, high_refund_rate, high_refund_amount_ratio, rapid_full_refunds (confirmedFraud=false)."
    }
  ],
  "limitations": [
    "Payment records, invoices, identity rows, and transaction histories are copied only from caller-supplied fields. Payment processors and financial accounts are never contacted.",
    "Matching and velocity checks are deterministic local rules over supplied records. Missing values are not invented.",
    "Observed facts are separated from inferred risk hypotheses. Statistical anomalies alone are never labeled confirmed fraud.",
    "Personal and financial identifiers are masked in responses (email local-part hashed length, last4 only for cards/accounts).",
    "No paid fraud-intel feed is used and no API key is required."
  ]
}

cURL

curl -i -X POST "https://www.brainiac.software/api/v1/fraud-signals/refund-abuse-pattern-detect" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "asOf": "2026-11-04T21:00:00.000Z",
  "refundWindowDays": 30,
  "payments": [
    {
      "id": "P1",
      "at": "2026-11-01T12:00:00.000Z",
      "customerId": "C3",
      "eventType": "purchase",
      "status": "completed",
      "amount": 80,
      "currency": "USD",
      "source": "Caller-supplied"
    },
    {
      "id": "P2",
      "at": "2026-11-01T18:00:00.000Z",
      "customerId": "C3",
      "eventType": "refund",
      "status": "refunded",
      "amount": 80,
      "currency": "USD",
      "source": "Caller-supplied"
    },
    {
      "id": "P3",
      "at": "2026-11-02T12:00:00.000Z",
      "customerId": "C3",
      "eventType": "purchase",
      "status": "completed",
      "amount": 60,
      "currency": "USD",
      "source": "Caller-supplied"
    },
    {
      "id": "P4",
      "at": "2026-11-02T16:00:00.000Z",
      "customerId": "C3",
      "eventType": "refund",
      "status": "refunded",
      "amount": 60,
      "currency": "USD",
      "source": "Caller-supplied"
    },
    {
      "id": "P5",
      "at": "2026-11-03T12:00:00.000Z",
      "customerId": "C3",
      "eventType": "purchase",
      "status": "completed",
      "amount": 40,
      "currency": "USD",
      "source": "Caller-supplied"
    },
    {
      "id": "P6",
      "at": "2026-11-03T15:00:00.000Z",
      "customerId": "C3",
      "eventType": "refund",
      "status": "refunded",
      "amount": 40,
      "currency": "USD",
      "source": "Caller-supplied"
    }
  ]
}
JSON

POSThttps://www.brainiac.software/api/v1/fraud-signals/chargeback-pattern-analyze$0.04 USDC

Analyze chargeback patterns

Analyze recurring chargeback/dispute patterns from caller-supplied payment records. Elevated rates are indicators, not confirmed fraud.

Body

Field	Required	Notes
`text`	No	string
`json`	No	string
`csv`	No	string
`file`	No	object; Object
`files`	No	array; Array
`payments`	No	array; Array
`transactions`	No	array; Array
`identities`	No	array; Array
`invoices`	No	array; Array
`asOf`	No	string
`velocityWindowMinutes`	No	number
`velocityCountThreshold`	No	number
`velocityAmountThreshold`	No	number
`refundWindowDays`	No	number
`chargebackWindowDays`	No	number
`bankChangeRiskHours`	No	number

Request exampleJSON

{
  "asOf": "2026-11-04T21:00:00.000Z",
  "chargebackWindowDays": 90,
  "payments": [
    {
      "id": "P1",
      "at": "2026-10-01T12:00:00.000Z",
      "customerId": "C4",
      "merchantId": "M1",
      "eventType": "purchase",
      "status": "completed",
      "amount": 50,
      "currency": "USD",
      "cardLast4": "1001",
      "source": "Caller-supplied"
    },
    {
      "id": "P2",
      "at": "2026-10-10T12:00:00.000Z",
      "customerId": "C4",
      "merchantId": "M1",
      "eventType": "chargeback",
      "status": "chargeback",
      "amount": 50,
      "currency": "USD",
      "cardLast4": "1001",
      "reason": "fraud - unauthorized",
      "source": "Caller-supplied"
    },
    {
      "id": "P3",
      "at": "2026-10-20T12:00:00.000Z",
      "customerId": "C4",
      "merchantId": "M1",
      "eventType": "purchase",
      "status": "completed",
      "amount": 70,
      "currency": "USD",
      "cardLast4": "2002",
      "source": "Caller-supplied"
    },
    {
      "id": "P4",
      "at": "2026-10-25T12:00:00.000Z",
      "customerId": "C4",
      "merchantId": "M1",
      "eventType": "chargeback",
      "status": "chargeback",
      "amount": 70,
      "currency": "USD",
      "cardLast4": "2002",
      "reason": "not recognized",
      "source": "Caller-supplied"
    },
    {
      "id": "P5",
      "at": "2026-11-01T12:00:00.000Z",
      "customerId": "C4",
      "merchantId": "M1",
      "eventType": "chargeback",
      "status": "chargeback",
      "amount": 30,
      "currency": "USD",
      "cardLast4": "3003",
      "reason": "fraud",
      "source": "Caller-supplied"
    }
  ]
}

Response exampleJSON

{
  "checkedAt": "2026-11-04T21:00:00.000Z",
  "status": "detected",
  "itemCount": 1,
  "windowDays": 90,
  "items": [
    {
      "id": "chargeback-c4",
      "detector": "chargeback-pattern-analyze",
      "title": "Recurring chargeback pattern",
      "status": "signal",
      "observedFacts": [
        "3 chargebacks/disputes within 90 days.",
        "3 chargebacks cite fraud/unauthorized wording.",
        "Chargeback/purchase count ratio ≈150%.",
        "Chargebacks span 3 card last4 values."
      ],
      "inferredThreat": "Recurring chargebacks can indicate fraud or fulfillment issues; rate alone is not confirmed fraud.",
      "confidence": "medium",
      "relatedRecordIds": [
        "P2",
        "P4",
        "P5"
      ],
      "firstAt": "2026-10-10T12:00:00.000Z",
      "lastAt": "2026-11-01T12:00:00.000Z",
      "reasons": [
        "repeat_chargebacks",
        "fraud_reason_codes",
        "elevated_chargeback_rate",
        "multi_card_chargebacks"
      ],
      "evidence": [
        {
          "recordId": "P2",
          "at": "2026-10-10T12:00:00.000Z",
          "fact": "chargeback status=chargeback; USD 50; card…1001; reason=fraud - unauthorized",
          "inference": "Chargeback-pattern indicator only.",
          "confidence": "medium"
        },
        {
          "recordId": "P4",
          "at": "2026-10-25T12:00:00.000Z",
          "fact": "chargeback status=chargeback; USD 70; card…2002; reason=not recognized",
          "inference": "Chargeback-pattern indicator only.",
          "confidence": "medium"
        },
        {
          "recordId": "P5",
          "at": "2026-11-01T12:00:00.000Z",
          "fact": "chargeback status=chargeback; USD 30; card…3003; reason=fraud",
          "inference": "Chargeback-pattern indicator only.",
          "confidence": "medium"
        }
      ],
      "source": "Caller-supplied payments; local chargeback rules",
      "confirmedFraud": false
    }
  ],
  "paidProviderUsed": false,
  "apiKeyRequired": false,
  "paymentProcessorConnected": false,
  "financialAccountAccessed": false,
  "networkAccessed": false,
  "confirmedFraudClaimed": false,
  "findings": [
    {
      "kind": "conflict",
      "code": "chargeback_pattern",
      "subject": "c4",
      "detail": "Chargeback indicators: repeat_chargebacks, fraud_reason_codes, elevated_chargeback_rate, multi_card_chargebacks (confirmedFraud=false)."
    }
  ],
  "limitations": [
    "Payment records, invoices, identity rows, and transaction histories are copied only from caller-supplied fields. Payment processors and financial accounts are never contacted.",
    "Matching and velocity checks are deterministic local rules over supplied records. Missing values are not invented.",
    "Observed facts are separated from inferred risk hypotheses. Statistical anomalies alone are never labeled confirmed fraud.",
    "Personal and financial identifiers are masked in responses (email local-part hashed length, last4 only for cards/accounts).",
    "No paid fraud-intel feed is used and no API key is required."
  ]
}

cURL

curl -i -X POST "https://www.brainiac.software/api/v1/fraud-signals/chargeback-pattern-analyze" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "asOf": "2026-11-04T21:00:00.000Z",
  "chargebackWindowDays": 90,
  "payments": [
    {
      "id": "P1",
      "at": "2026-10-01T12:00:00.000Z",
      "customerId": "C4",
      "merchantId": "M1",
      "eventType": "purchase",
      "status": "completed",
      "amount": 50,
      "currency": "USD",
      "cardLast4": "1001",
      "source": "Caller-supplied"
    },
    {
      "id": "P2",
      "at": "2026-10-10T12:00:00.000Z",
      "customerId": "C4",
      "merchantId": "M1",
      "eventType": "chargeback",
      "status": "chargeback",
      "amount": 50,
      "currency": "USD",
      "cardLast4": "1001",
      "reason": "fraud - unauthorized",
      "source": "Caller-supplied"
    },
    {
      "id": "P3",
      "at": "2026-10-20T12:00:00.000Z",
      "customerId": "C4",
      "merchantId": "M1",
      "eventType": "purchase",
      "status": "completed",
      "amount": 70,
      "currency": "USD",
      "cardLast4": "2002",
      "source": "Caller-supplied"
    },
    {
      "id": "P4",
      "at": "2026-10-25T12:00:00.000Z",
      "customerId": "C4",
      "merchantId": "M1",
      "eventType": "chargeback",
      "status": "chargeback",
      "amount": 70,
      "currency": "USD",
      "cardLast4": "2002",
      "reason": "not recognized",
      "source": "Caller-supplied"
    },
    {
      "id": "P5",
      "at": "2026-11-01T12:00:00.000Z",
      "customerId": "C4",
      "merchantId": "M1",
      "eventType": "chargeback",
      "status": "chargeback",
      "amount": 30,
      "currency": "USD",
      "cardLast4": "3003",
      "reason": "fraud",
      "source": "Caller-supplied"
    }
  ]
}
JSON

POSThttps://www.brainiac.software/api/v1/fraud-signals/multi-account-fraud-cluster$0.05 USDC

Cluster related fraud accounts

Group potentially related accounts using deterministic overlap of caller-supplied emails, phones, devices, IPs, and payment-instrument last4 values. Linkage is not confirmed fraud.

Body

Field	Required	Notes
`text`	No	string
`json`	No	string
`csv`	No	string
`file`	No	object; Object
`files`	No	array; Array
`payments`	No	array; Array
`transactions`	No	array; Array
`identities`	No	array; Array
`invoices`	No	array; Array
`asOf`	No	string
`velocityWindowMinutes`	No	number
`velocityCountThreshold`	No	number
`velocityAmountThreshold`	No	number
`refundWindowDays`	No	number
`chargebackWindowDays`	No	number
`bankChangeRiskHours`	No	number

Request exampleJSON

{
  "asOf": "2026-11-04T21:00:00.000Z",
  "payments": [
    {
      "id": "P1",
      "at": "2026-11-04T12:00:00.000Z",
      "accountId": "A1",
      "customerId": "C1",
      "email": "shared@example.com",
      "deviceId": "dev-9",
      "ip": "203.0.113.9",
      "cardLast4": "4242",
      "eventType": "purchase",
      "status": "completed",
      "amount": 20,
      "currency": "USD",
      "source": "Caller-supplied"
    },
    {
      "id": "P2",
      "at": "2026-11-04T13:00:00.000Z",
      "accountId": "A2",
      "customerId": "C2",
      "email": "shared@example.com",
      "deviceId": "dev-9",
      "ip": "203.0.113.9",
      "cardLast4": "4242",
      "eventType": "purchase",
      "status": "completed",
      "amount": 25,
      "currency": "USD",
      "source": "Caller-supplied"
    }
  ],
  "identities": [
    {
      "id": "I1",
      "accountId": "A1",
      "email": "shared@example.com",
      "phone": "+1-555-0100",
      "source": "Caller-supplied"
    },
    {
      "id": "I2",
      "accountId": "A2",
      "email": "other@example.com",
      "phone": "+1-555-0100",
      "deviceId": "dev-9",
      "source": "Caller-supplied"
    }
  ]
}

Response exampleJSON

{
  "checkedAt": "2026-11-04T21:00:00.000Z",
  "status": "detected",
  "itemCount": 1,
  "items": [
    {
      "id": "cluster-i2",
      "detector": "multi-account-fraud-cluster",
      "title": "Related-account fraud cluster",
      "observedFacts": [
        "Cluster links 4 records across 2 account id(s).",
        "Shared evidence keys: email, phone, deviceId, ip, payment_instrument."
      ],
      "inferredThreat": "Shared identifiers across accounts can indicate multi-accounting; linkage is not confirmed fraud.",
      "confidence": "high",
      "relatedRecordIds": [
        "P1",
        "P2",
        "I1",
        "I2"
      ],
      "firstAt": "2026-11-04T21:00:00.000Z",
      "lastAt": "2026-11-04T21:00:00.000Z",
      "reasons": [
        "shared_identifiers",
        "shared_email",
        "shared_phone",
        "shared_deviceId",
        "shared_ip",
        "shared_payment_instrument"
      ],
      "evidence": [
        {
          "recordId": "P1",
          "at": "2026-11-04T21:00:00.000Z",
          "fact": "kind=payment; account=A1; email=s***@example.com; phone=n/a; device=dev-9",
          "inference": "Cluster membership via deterministic identifier overlap.",
          "confidence": "medium"
        },
        {
          "recordId": "P2",
          "at": "2026-11-04T21:00:00.000Z",
          "fact": "kind=payment; account=A2; email=s***@example.com; phone=n/a; device=dev-9",
          "inference": "Cluster membership via deterministic identifier overlap.",
          "confidence": "medium"
        },
        {
          "recordId": "I1",
          "at": "2026-11-04T21:00:00.000Z",
          "fact": "kind=identity; account=A1; email=s***@example.com; phone=***0100; device=n/a",
          "inference": "Cluster membership via deterministic identifier overlap.",
          "confidence": "medium"
        },
        {
          "recordId": "I2",
          "at": "2026-11-04T21:00:00.000Z",
          "fact": "kind=identity; account=A2; email=o***@example.com; phone=***0100; device=dev-9",
          "inference": "Cluster membership via deterministic identifier overlap.",
          "confidence": "medium"
        }
      ],
      "source": "Caller-supplied payments/identities; deterministic identifier clustering",
      "status": "signal",
      "confirmedFraud": false
    }
  ],
  "paidProviderUsed": false,
  "apiKeyRequired": false,
  "paymentProcessorConnected": false,
  "financialAccountAccessed": false,
  "networkAccessed": false,
  "confirmedFraudClaimed": false,
  "findings": [
    {
      "kind": "conflict",
      "code": "fraud_cluster",
      "subject": "I2",
      "detail": "Multi-account cluster via email, phone, deviceId, ip, payment_instrument (confirmedFraud=false)."
    }
  ],
  "limitations": [
    "Payment records, invoices, identity rows, and transaction histories are copied only from caller-supplied fields. Payment processors and financial accounts are never contacted.",
    "Matching and velocity checks are deterministic local rules over supplied records. Missing values are not invented.",
    "Observed facts are separated from inferred risk hypotheses. Statistical anomalies alone are never labeled confirmed fraud.",
    "Personal and financial identifiers are masked in responses (email local-part hashed length, last4 only for cards/accounts).",
    "No paid fraud-intel feed is used and no API key is required."
  ]
}

cURL

curl -i -X POST "https://www.brainiac.software/api/v1/fraud-signals/multi-account-fraud-cluster" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "asOf": "2026-11-04T21:00:00.000Z",
  "payments": [
    {
      "id": "P1",
      "at": "2026-11-04T12:00:00.000Z",
      "accountId": "A1",
      "customerId": "C1",
      "email": "shared@example.com",
      "deviceId": "dev-9",
      "ip": "203.0.113.9",
      "cardLast4": "4242",
      "eventType": "purchase",
      "status": "completed",
      "amount": 20,
      "currency": "USD",
      "source": "Caller-supplied"
    },
    {
      "id": "P2",
      "at": "2026-11-04T13:00:00.000Z",
      "accountId": "A2",
      "customerId": "C2",
      "email": "shared@example.com",
      "deviceId": "dev-9",
      "ip": "203.0.113.9",
      "cardLast4": "4242",
      "eventType": "purchase",
      "status": "completed",
      "amount": 25,
      "currency": "USD",
      "source": "Caller-supplied"
    }
  ],
  "identities": [
    {
      "id": "I1",
      "accountId": "A1",
      "email": "shared@example.com",
      "phone": "+1-555-0100",
      "source": "Caller-supplied"
    },
    {
      "id": "I2",
      "accountId": "A2",
      "email": "other@example.com",
      "phone": "+1-555-0100",
      "deviceId": "dev-9",
      "source": "Caller-supplied"
    }
  ]
}
JSON